CVE-2026-89639

A flaw was found in the Linux kernel's Common Internet File System CIFS implementation. When a file is truncated, the cifsdotruncate function does not properly invalidate the file system cache fscache. This oversight can lead to stale cached data being served to users, potentially resulting in...

AZL-100142 CVE-2026-89713 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsdsetattr checks whether a size update needs NFSDMAYTRUNC before it takes inodelock. The comparison uses the file size sampled by that unlocked read, but the actual ATTRSIZE upda...

CVE-2026-89713 NFSD: check truncate permission under inode lock

In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsdsetattr checks whether a size update needs NFSDMAYTRUNC before it takes inodelock. The comparison uses the file size sampled by that unlocked read, but the actual ATTRSIZE upda...

CVE-2026-89713

In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsdsetattr checks whether a size update needs NFSDMAYTRUNC before it takes inodelock. The comparison uses the file size sampled by that unlocked read, but the actual ATTRSIZE upda...

PT-2026-90429

In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsd setattr checks whether a size update needs NFSD MAY TRUNC before it takes inode lock. The comparison uses the file size sampled by that unlocked read, but the actual ATTR SIZE...

PT-2026-90355

In the Linux kernel, the following vulnerability has been resolved: cifs: use cifs invalidate cache in cifs do truncate for O TRUNC cifs do truncate is invoked from cifs open without i rwsem, so it cannot use cifs resize file locked to perform a proper fscache cookie resize. Instead, add cifs...

openSUSE 16 Security Update : fuse-overlayfs (openSUSE-SU-2026:21753-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21753-1 advisory. This update for fuse-overlayfs fixes the following issue: - CVE-2026-52791: privilege escalation due to SUID/SGID bit preservation after truncate...

AZL-99419 CVE-2026-80856 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: fuse: fix invalidate lock leak on setattr writeback failure fusedosetattr takes filemapinvalidatelock for a DAX truncate faultblocked = true and releases it at the out:/error: labels. But when a writeback flush is also needed, a...

CVE-2026-80856 fuse: fix invalidate lock leak on setattr writeback failure

In the Linux kernel, the following vulnerability has been resolved: fuse: fix invalidate lock leak on setattr writeback failure fusedosetattr takes filemapinvalidatelock for a DAX truncate faultblocked = true and releases it at the out:/error: labels. But when a writeback flush is also needed, a...

EUVD-2026-71305

In the Linux kernel, the following vulnerability has been resolved: fuse: fix invalidate lock leak on open OTRUNC DAX failure fuseopen takes filemapinvalidatelock for a DAX truncate daxtruncate = true and releases it before the outinodeunlock label. But when fusedaxbreaklayouts fails, the goto...

CVE-2026-80855

CVE-2026-80855 affects the Linux kernel FUSE filesystem. In fuse_open(), when a DAX truncate (O_TRUNC) triggers filemap_invalidate_lock(), a subsequent failure in fuse_dax_break_layouts() (e.g., returning -ERESTARTSYS after a signal interrupts the wait for busy DAX pages to drain) causes the code...

Linux Distros Unpatched Vulnerability : CVE-2026-80856

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fuse: fix invalidate lock leak on setattr writeback failure fusedosetattr takes filemapinvalidatelock for a DAX truncate faultblocked = true and releases it at...

Linux Distros Unpatched Vulnerability : CVE-2026-80855

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fuse: fix invalidate lock leak on open OTRUNC DAX failure fuseopen takes filemapinvalidatelock for a DAX truncate daxtruncate = true and releases it before the...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Do not hold the nilock lock when calling truncatesetsize. syzbot reports a hung task during the call to douseraddrfault 1. This occurs because there is a silent deadlock between the PGlocked bit and the nilock lock. Sin...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: iomap: added protection against concurrent truncate and underflow operations. iomap: fixed the issue where zero-padding occurred during concurrent append writes. The accounting of ioend was changed so that iosize only tracks...

Astra Linux – Vulnerability in Python-Django

In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the chars and words methods from django.utils.text.Truncator when used with html=True are susceptible to a potential DoS denial of service attack due to certain inputs containing very long, potentially malformed HTML text. The...

Astra Linux – Vulnerability in Node-Elliptic

The Elliptic package 6.5.7 for Node.js, in its ECDSA implementation, does not correctly verify valid signatures when the hash contains at least four leading 0 bytes, and when the order of the elliptic curve’s base point is smaller than the hash, due to an truncateToN anomaly. This results in vali...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ntfs3: init run lock for extend inode After setting the inode mode of $Extend to a regular file, executing the truncate system call will invoke the dotruncate routine, resulting in an uninitialized runlock error reported by syzbo...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: hfsplus: prevented corruption during the shrinking of truncate operations. I believe there are some issues introduced by commit 31651c607151 “hfsplus: avoided deadlock during file truncation”. HFS+ uses extent records, which alwa...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: block: Fixed an incorrect offset in biotruncate The biotruncate function clears the buffer outside of the last block of bdev. However, the current implementation of biotruncate uses the wrong offset for the page. As a result, it...